Skip to content

[Security Solution] [Attacks/Alerts] Flyout: Move attack transform functions#255442

Merged
agusruidiazgd merged 10 commits into
elastic:mainfrom
agusruidiazgd:feat/move-attack-transform-functions
Mar 6, 2026
Merged

[Security Solution] [Attacks/Alerts] Flyout: Move attack transform functions#255442
agusruidiazgd merged 10 commits into
elastic:mainfrom
agusruidiazgd:feat/move-attack-transform-functions

Conversation

@agusruidiazgd
Copy link
Copy Markdown
Contributor

@agusruidiazgd agusruidiazgd commented Mar 2, 2026 •
edited
Loading

Summary

This PR moves attack discovery transform utilities from the Security Solution / Elastic Assistant plugin into the shared package @kbn/elastic-assistant-common, so they can be reused across plugins (e.g. Security Solution, Elastic Assistant, Cases) and to keep API↔internal conversion logic in one place.

Changes:

  • Moved to kbn-elastic-assistant-common:
    • Alert transforms: transformAttackDiscoveryAlertFromApi, transformAttackDiscoveryAlertToApi
    • Schedule transforms: transformAttackDiscoveryScheduleFromApi, transformAttackDiscoveryScheduleToApi, plus create/update props variants (*ToApi / *FromApi) and schedule actions props transforms
    • Attack discovery helpers: getOriginalAlertIds, getTacticLabel, getTacticMetadata, replaceNewlineLiterals, transformInternalReplacements (from attack discovery helpers)
  • Updated consumers in elastic_assistant and security_solution (and any other plugins that used these) to import from @kbn/elastic-assistant-common instead of local paths.
  • Config/imports adjusted so the common package builds and type-checks correctly and all references are consistent.

No new UI or user-facing behavior; this is a refactor to centralize attack discovery transform and helper logic.

@agusruidiazgd agusruidiazgd self-assigned this Mar 2, 2026
@agusruidiazgd agusruidiazgd added the ci:cloud-deploy Create or update a Cloud deployment label Mar 2, 2026
@agusruidiazgd agusruidiazgd added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:Threat Hunting Security Solution Threat Hunting Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team v9.4.0 labels Mar 3, 2026
@agusruidiazgd agusruidiazgd marked this pull request as ready for review March 3, 2026 11:16
@agusruidiazgd agusruidiazgd requested review from a team as code owners March 3, 2026 11:16
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 3, 2026

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 3, 2026

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 3, 2026

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Mar 5, 2026 •
edited
Loading

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] Jest Tests #7 / discover responsive sidebar should render buttons in data view picker correctly

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
agentBuilder 1709 1726 +17
apm 2262 2067 -195
automaticImport 1088 1105 +17
cases 1550 1554 +4
datasetQuality 1231 1120 -111
discover 2100 1972 -128
elasticAssistant 636 653 +17
embeddableAlertsTable 651 456 -195
fleet 1659 1464 -195
infra 2010 1815 -195
maintenanceWindows 368 173 -195
ml 4293 4098 -195
monitoring 808 613 -195
observability 1903 1708 -195
observabilityAIAssistantApp 979 784 -195
observabilityShared 378 183 -195
securitySolution 9128 9132 +4
slo 1464 1269 -195
stackAlerts 421 226 -195
synthetics 1451 1256 -195
timelines 345 150 -195
transform 866 671 -195
triggersActionsUi 1325 1329 +4
uptime 953 758 -195
workflowsManagement 1332 1204 -128
workplaceAIApp 1026 1043 +17
total -3407

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id before after diff
@kbn/elastic-assistant-common 705 740 +35
@kbn/rule-data-utils 214 215 +1
total +36

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
cases 1.7MB 1.7MB +3.0B
securitySolution 11.3MB 11.3MB -1.0B
triggersActionsUi 1.9MB 1.9MB +8.0B
total +10.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 271.5KB 271.4KB -73.0B
triggersActionsUi 109.2KB 109.1KB -72.0B
total -145.0B
Unknown metric groups

API count

id before after diff
@kbn/elastic-assistant-common 831 867 +36
@kbn/rule-data-utils 227 228 +1
total +37

History

cc @agusruidiazgd

@banderror banderror requested review from a team and nikitaindik March 5, 2026 10:57
@banderror banderror requested a review from nkhristinin March 5, 2026 10:57
e40pud
e40pud approved these changes Mar 5, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@e40pud e40pud left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for restructuring this! 🚀

nikitaindik
nikitaindik approved these changes Mar 5, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@nikitaindik nikitaindik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the refactor! I read through the changes in "Detections and Response" owned files. It all looks good to me.

nkhristinin
nkhristinin approved these changes Mar 6, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@nkhristinin nkhristinin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DE changes code review LGTM

@agusruidiazgd agusruidiazgd merged commit c43e84b into elastic:main Mar 6, 2026
16 checks passed
kapral18 pushed a commit to kapral18/kibana that referenced this pull request Mar 9, 2026
@agusruidiazgd @e40pud
@kibanamachine @kapral18
[Security Solution] [Attacks/Alerts] Flyout: Move attack transform fu…
6512bc6 
…nctions (elastic#255442)

## Summary

This PR moves attack discovery transform utilities from the Security
Solution / Elastic Assistant plugin into the shared package
`@kbn/elastic-assistant-common`, so they can be reused across plugins
(e.g. Security Solution, Elastic Assistant, Cases) and to keep
API↔internal conversion logic in one place.

**Changes:**

- **Moved to `kbn-elastic-assistant-common`:**
- **Alert transforms:** `transformAttackDiscoveryAlertFromApi`,
`transformAttackDiscoveryAlertToApi`
- **Schedule transforms:** `transformAttackDiscoveryScheduleFromApi`,
`transformAttackDiscoveryScheduleToApi`, plus create/update props
variants (`*ToApi` / `*FromApi`) and schedule actions props transforms
- **Attack discovery helpers:** `getOriginalAlertIds`, `getTacticLabel`,
`getTacticMetadata`, `replaceNewlineLiterals`,
`transformInternalReplacements` (from attack discovery helpers)
- **Updated consumers** in `elastic_assistant` and `security_solution`
(and any other plugins that used these) to import from
`@kbn/elastic-assistant-common` instead of local paths.
- **Config/imports** adjusted so the common package builds and
type-checks correctly and all references are consistent.

No new UI or user-facing behavior; this is a refactor to centralize
attack discovery transform and helper logic.

---------

Co-authored-by: Ievgen Sorokopud <ievgen.sorokopud@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
qn895 pushed a commit to qn895/kibana that referenced this pull request Mar 11, 2026
@agusruidiazgd @e40pud
@kibanamachine @qn895
[Security Solution] [Attacks/Alerts] Flyout: Move attack transform fu…
56dab02 
…nctions (elastic#255442)

## Summary

This PR moves attack discovery transform utilities from the Security
Solution / Elastic Assistant plugin into the shared package
`@kbn/elastic-assistant-common`, so they can be reused across plugins
(e.g. Security Solution, Elastic Assistant, Cases) and to keep
API↔internal conversion logic in one place.

**Changes:**

- **Moved to `kbn-elastic-assistant-common`:**
- **Alert transforms:** `transformAttackDiscoveryAlertFromApi`,
`transformAttackDiscoveryAlertToApi`
- **Schedule transforms:** `transformAttackDiscoveryScheduleFromApi`,
`transformAttackDiscoveryScheduleToApi`, plus create/update props
variants (`*ToApi` / `*FromApi`) and schedule actions props transforms
- **Attack discovery helpers:** `getOriginalAlertIds`, `getTacticLabel`,
`getTacticMetadata`, `replaceNewlineLiterals`,
`transformInternalReplacements` (from attack discovery helpers)
- **Updated consumers** in `elastic_assistant` and `security_solution`
(and any other plugins that used these) to import from
`@kbn/elastic-assistant-common` instead of local paths.
- **Config/imports** adjusted so the common package builds and
type-checks correctly and all references are consistent.

No new UI or user-facing behavior; this is a refactor to centralize
attack discovery transform and helper logic.

---------

Co-authored-by: Ievgen Sorokopud <ievgen.sorokopud@elastic.co>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
@davethegut davethegut mentioned this pull request Mar 19, 2026
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@e40pud e40pud e40pud approved these changes

@nkhristinin nkhristinin nkhristinin approved these changes

@nikitaindik nikitaindik nikitaindik approved these changes

@jcger jcger jcger approved these changes

@benakansara benakansara benakansara approved these changes

Assignees

@agusruidiazgd agusruidiazgd

Labels

backport:skip This PR does not require backporting ci:cloud-deploy Create or update a Cloud deployment release_note:skip Skip the PR/issue when compiling release notes Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Investigations Security Solution Threat Hunting Investigations Team Team:Threat Hunting Security Solution Threat Hunting Team v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@agusruidiazgd @elasticmachine @e40pud @nkhristinin @nikitaindik @jcger @benakansara @kibanamachine